[cfid-608] Password grants do not filter scope for user groups

This problem goes pretty deep into the authentication model
for the TokenEndpoint, so I think the fix should come from
Spring OAuth.

When an authorization request is being generated, it could
be a plain old UsernamePasswordAuthenticationToken
in the case of a password grant.  The old code worked but only for
an implicit grant.  The new version actually makes sure it
is an OAuth2AuthenticationToken

[Fixes #44363579] [cfid-608] Password grants do not filter scope for user's groups

Change-Id: Ic194cc38bdbf2f90b4a90c32effdb348a0c4e4a0
Remove the token store. Change refresh tokens to jwt.

Also includes:
- Removal of the token admin endpoints
- Expire refresh tokens when the user changes their password
- Remove the token lookup from the app sample
- Remove the need for a separate refresh grant. Authcode and password grants will
  automatically get a refresh token.
- Updated app sample with a link to revoke approvals
- Remove the tokens.* scopes

[#44041363]
[#43589475]
[#38710223]

Change-Id: I96737fece7356e9ae00c7daa2edfd102e2c445e7
Merge pull request #10 from joeldsa/feature/remove_token_store

Remove the token store. Change refresh tokens to jwt.
Fix broken integration test
[cfid-616] Add /info template to /api sample

[#44453639] [cfid-616] Switching authentication manager in the login server only works for webapp
Check approvals before issuing a new refresh token

Only issue the token if all the requested scopes have
unexpired approvals made before the refresh token was issued.

[#42875031]
[#42984673]
[cfid-616] Ensure vmc works with sample api

[#44453639] [cfid-616] Switching authentication manager in the login server only works for webapp
Update README.md
Bug fix to the approval check during access token refresh

The update date was not being set correctly.
Fix sample app so it has a link to approvals UI
Expand information available from RemoteTokenServices

[Fixes #44528237] Support resource servers that want more information from tokens
Fix license header
Consider auto approved scopes when deciding whether refresh tokens are valid

[#44564885]
Add contributor guidelines to README
Consider auto approved scopes on the approvals display

Auto approved scopes are not stored and not displayed
They are looked at when calculating the scopes to be granted
to a token.

[#44577319]
Fixed a bug where if the user denies all scopes, an incorrect token would be generated
Improve request dumping.

Now logs request method and URI together with
headers for readability.